Re: Fake paypal email triggers -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM

2025-01-29 Thread Alan via users
As far as I can tell, they're valid notifications from PayPal, and probably useful for legitimate purposes. What the messages are doing is attempting to trigger sufficient anxiety that the recipient calls the phone number in the message, which connects them to a scammer. It will get worse, and

Score for KAM_LIST3_1

2025-07-30 Thread Alan via users
I got a FP on this rule, which isn't really that bad, save for the default score of 5.75. That's enough to get a spam classification on it's own. I've adjusted the score locally but the default seems a tad heavy. I'm giving it a 3.25. -- For SpamAssassin Users List